fd2d7cf1a20f422e6210a51464f90a3ec9013e1e19f88ca701dd9190afa65b4a

Analysis

max time kernel
79s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 17:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan.Win32.Hesv.cizl.exe
Size 5.7MB
Sample261018-wft3jaca49
SHA256 fd2d7cf1a20f422e6210a51464f90a3ec9013e1e19f88ca701dd9190afa65b4a
MD5 03de05d0ee229e2238499946baa42193
SHA1 7f474dc9efad044688e6d0d8a202766b9959e6ea
SHA512 8484c0b179633758039fee1486c9a4734fe1077062c7f38237ce33a38b6f4bc3040c78646a4d13d8815fd3444023823a2a056e93d4823e4c3a1ba0f187f5f283
SSDEEP 98304:QHu3l8mnILHAmqOhlJuy2ZCmq2HK+B8SRDJdbLca+hb1oFj6seR8Nrt4t5l1RgJ:mqe0QlJuy2Z7KoxRDJdbLcaaCdva8NZ3
TLSH
T106563361FD618CEFDCF3E3342F1E26808C9FBEDE113458142A25996D2C09AA9D58F653
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer macro persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
4620	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp
2960	tscc.exe
5512	GLB3A0D.tmp
4564	Excel Edit Formulas Software.exe

Loads dropped DLL 14 IoCs

pid	Process
4780	regsvr32.exe
2240	regsvr32.exe
3852	regsvr32.exe
572	regsvr32.exe
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
4564	Excel Edit Formulas Software.exe
4564	Excel Edit Formulas Software.exe
4564	Excel Edit Formulas Software.exe
4564	Excel Edit Formulas Software.exe
4564	Excel Edit Formulas Software.exe
4564	Excel Edit Formulas Software.exe
4564	Excel Edit Formulas Software.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Excel Edit Formulas Software.exe	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\D:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\D:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe

Document created with cracked Office version 2 IoCs

Office document contains Grizli777 string known to be caused by using a cracked version of the software.

macro

resource	yara_rule
behavioral2/files/0x000d00000001c53e-768.dat	grizli777_cracked_office
behavioral2/files/0x000d00000001c53f-769.dat	grizli777_cracked_office

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\~GLH0001.TMP	GLB3A0D.tmp
File opened for modification	C:\Windows\SysWOW64\tsccvid.dll	GLB3A0D.tmp
File created	C:\Windows\SysWOW64\temp.000	GLB3A0D.tmp

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Excel Edit Formulas Software\unins000.dat	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp
File created	C:\Program Files (x86)\Excel Edit Formulas Software\x\is-I8TGR.tmp	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp
File created	C:\Program Files (x86)\Excel Edit Formulas Software\Splash\is-VOJUB.tmp	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp
File created	C:\Program Files (x86)\Excel Edit Formulas Software\is-49HJ4.tmp	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp
File created	C:\Program Files (x86)\Excel Edit Formulas Software\is-U1QT4.tmp	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp
File created	C:\Program Files (x86)\Excel Edit Formulas Software\is-H21TM.tmp	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp
File created	C:\Program Files (x86)\Excel Edit Formulas Software\Samples\is-RUJNO.tmp	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp
File created	C:\Program Files (x86)\Excel Edit Formulas Software\is-BJ0G9.tmp	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp
File created	C:\Program Files (x86)\Excel Edit Formulas Software\x\is-KT7AV.tmp	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp
File opened for modification	C:\Program Files (x86)\Excel Edit Formulas Software\unins000.dat	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp
File created	C:\Program Files (x86)\Excel Edit Formulas Software\is-MMIUL.tmp	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp
File created	C:\Program Files (x86)\Excel Edit Formulas Software\is-GGOA0.tmp	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp
File created	C:\Program Files (x86)\Excel Edit Formulas Software\is-4RLE0.tmp	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp
File created	C:\Program Files (x86)\Excel Edit Formulas Software\is-CDQQ5.tmp	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp
File created	C:\Program Files (x86)\Excel Edit Formulas Software\Video\is-BQSKG.tmp	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp
File created	C:\Program Files (x86)\Excel Edit Formulas Software\x\is-1JJGR.tmp	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp
File created	C:\Program Files (x86)\Excel Edit Formulas Software\Samples\is-J3HHC.tmp	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_1864_1829831596\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_111_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1019619331\_locales\el\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GLB3A0D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Excel Edit Formulas Software.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.Hesv.cizl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tscc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3252	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/3820-1-0x0000000000400000-0x0000000000414000-memory.dmp	innosetup
behavioral2/memory/3820-16-0x0000000000400000-0x0000000000414000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{66833FEB-8583-11D1-B16A-00C0F0283628}\ = "IButtonMenus"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EA6BB978-31B8-4F06-99A6-17A150A6FBE2}\TypeLib\Version = "c.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DD8FFC2-771D-4652-8C75-7BE414CEA1E3}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6691B58E-6B74-4685-A640-DCEDF1258C1B}\TypeLib\Version = "c.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAE5A94F-59EC-4CFF-B0F7-643ADFD7D31E}\MiscStatus\1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Codejock.Slider.12.1.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE3C-8596-11D1-B16A-00C0F0283628}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{35053A21-8589-11D1-B16A-00C0F0283628}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1712672C-EC4A-4D21-90B9-E63C79E049EB}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{365EA527-D26D-4E8F-A262-4C58C6D2BDB6}\InprocServer32\ = "C:\\PROGRA~2\\EXCELE~1\\x\\sblc.ocx"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C4F3BE7-47EB-101B-A3C9-08002B2F49FB}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1EFB6595-857C-11D1-B16A-00C0F0283628}\ = "ITabStripEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{35053A21-8589-11D1-B16A-00C0F0283628}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{472644B1-DFF0-4E26-AA07-8E6A8A2FBC68}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8387AF8E-8EC0-4F4F-A4C3-434CBF7FAA9B}\ToolboxBitmap32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{43FEE0C8-5DBA-4B41-9E78-0EB36A1C755E}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.SBarCtrl\ = "Microsoft StatusBar Control 6.0 (SP6)"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{35053A20-8589-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1837751-7F27-46D2-91A1-0442FD6DA0DD}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1A3A7880-94DB-4CB4-B464-C61E47BADC23}\TypeLib\Version = "c.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7CF55A07-2981-4FB2-A62C-AC1422205590}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F74386B-B340-4BDC-AC8F-8DC574440065}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66833FE6-8583-11D1-B16A-00C0F0283628}\Version\ = "2.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{35053A20-8589-11D1-B16A-00C0F0283628}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C74190B8-8589-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5A27BEF8-8A82-4C0E-A4C5-611016DF6E3A}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{569C30D0-E2D7-4AE7-ACCF-EC2209058C15}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{10CAD5EC-8396-42F3-AA40-D02052CC7ADE}\ = "ListViewSubItems"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FBFC2581-B65D-4BFD-BF8D-F804BF7EA1E2}\ = "Xtreme MonthCalendar Control"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{68AD8A8C-492F-4741-AE86-42AF85CDFF1E}\MiscStatus	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComDlg.CommonDialog\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8E5842E-102B-4289-9D57-3B3F5B5E15D3}\c.1\0\win32\ = "C:\\Program Files (x86)\\Excel Edit Formulas Software\\x\\sblc.ocx"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7F855B4B-2201-4526-B914-94EC9D3FE1EF}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C004B65A-C283-4723-879C-19C940B59030}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C74190B6-8589-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C247F22-8591-11D1-B16A-00C0F0283628}\ = "ImageListEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CD4AEA20-D602-48A4-B28C-72943B4B5D82}\ = "ListViewItem"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BA45B9B-CB1A-42CE-B185-A1A236A41A33}\ProgID\ = "Codejock.TaskDialog.12.1.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}\2.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1EFB6595-857C-11D1-B16A-00C0F0283628}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8E3867A2-8586-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E5012C11-D6F7-4A60-BC80-6B4D58112A97}\TypeLib\Version = "c.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F9043C85-F6F2-101A-A3C9-08002B2F49FB}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE35-8596-11D1-B16A-00C0F0283628}\InprocServer32\ = "C:\\Program Files (x86)\\Excel Edit Formulas Software\\mscomctl.ocx"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EEE5891D-B4E9-45C7-AAF6-EF340E785590}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{51837751-7F27-46D2-91A1-0442FD6DA0DD}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CB2F496-5E7D-43C1-B9B7-8B082F07A2B1}\TypeLib\Version = "c.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53763D01-7EB8-4C71-ADF4-66ECB1275109}\ToolboxBitmap32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{083039C2-13F4-11D1-8B7E-0000F8754DA1}\TypeLib\Version = "1.2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66833FE6-8583-11D1-B16A-00C0F0283628}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BDD1F04C-858B-11D1-B16A-00C0F0283628}\ = "IListItems"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{02C32347-B64D-4F7E-ACB5-9C79AF4766F7}\TypeLib\ = "{A8E5842E-102B-4289-9D57-3B3F5B5E15D3}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F74386B-B340-4BDC-AC8F-8DC574440065}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ProgCtrl\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD9DA662-8594-11D1-B16A-00C0F0283628}\ = "IComboItems"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1366A5A0-53F5-436E-8A02-BF292AC38E38}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BA45B9B-CB1A-42CE-B185-A1A236A41A33}\Control	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{43FEE0C8-5DBA-4B41-9E78-0EB36A1C755E}\MiscStatus	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7E8DDC8B-606C-40A3-B6A3-C5661F75BA89}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{543B5471-51AE-4D83-A96A-4359B43B6F04}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{71837751-7F27-46D2-91A1-0442FD6DA0DD}\TypeLib\ = "{A8E5842E-102B-4289-9D57-3B3F5B5E15D3}"	regsvr32.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
752	EXCEL.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5500	unregmp2.exe
Token: SeCreatePagefilePrivilege	5500	unregmp2.exe
Token: SeShutdownPrivilege	2784	wmplayer.exe
Token: SeCreatePagefilePrivilege	2784	wmplayer.exe
Token: SeShutdownPrivilege	2784	wmplayer.exe
Token: SeCreatePagefilePrivilege	2784	wmplayer.exe

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
4620	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
2784	wmplayer.exe
1864	msedge.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp
5512	GLB3A0D.tmp

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4564	Excel Edit Formulas Software.exe
4564	Excel Edit Formulas Software.exe
4564	Excel Edit Formulas Software.exe
752	EXCEL.EXE
752	EXCEL.EXE
4564	Excel Edit Formulas Software.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3820 wrote to memory of 4620	3820	jaffacakes118_Trojan.Win32.Hesv.cizl.exe	88
PID 4620 wrote to memory of 4780	4620	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp	90
PID 4620 wrote to memory of 2240	4620	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp	91
PID 4620 wrote to memory of 3852	4620	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp	92
PID 4620 wrote to memory of 572	4620	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp	95
PID 4620 wrote to memory of 2960	4620	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp	96
PID 2960 wrote to memory of 5512	2960	tscc.exe	97
PID 4620 wrote to memory of 4564	4620	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp	98
PID 2784 wrote to memory of 5028	2784	wmplayer.exe	100
PID 5028 wrote to memory of 5500	5028	unregmp2.exe	101
PID 4564 wrote to memory of 1864	4564	Excel Edit Formulas Software.exe	106
PID 1864 wrote to memory of 5752	1864	msedge.exe	107
PID 1864 wrote to memory of 3252	1864	msedge.exe	108
PID 1864 wrote to memory of 5080	1864	msedge.exe	110
PID 1864 wrote to memory of 1596	1864	msedge.exe	109
PID 1864 wrote to memory of 5080	1864	msedge.exe	110
PID 1864 wrote to memory of 1596	1864	msedge.exe	109
PID 1864 wrote to memory of 1596	1864	msedge.exe	109
PID 1864 wrote to memory of 4824	1864	msedge.exe	112
PID 1864 wrote to memory of 4824	1864	msedge.exe	112
PID 1864 wrote to memory of 5788	1864	msedge.exe	113
PID 1864 wrote to memory of 4824	1864	msedge.exe	112
PID 1864 wrote to memory of 5788	1864	msedge.exe	113
PID 1864 wrote to memory of 5788	1864	msedge.exe	113
PID 1864 wrote to memory of 3484	1864	msedge.exe	114
PID 1864 wrote to memory of 4672	1864	msedge.exe	115
PID 1864 wrote to memory of 3484	1864	msedge.exe	114
PID 1864 wrote to memory of 3484	1864	msedge.exe	114
PID 1864 wrote to memory of 4672	1864	msedge.exe	115
PID 1864 wrote to memory of 4672	1864	msedge.exe	115
PID 4564 wrote to memory of 4860	4564	Excel Edit Formulas Software.exe	116
PID 1864 wrote to memory of 4972	1864	msedge.exe	117
PID 1864 wrote to memory of 4972	1864	msedge.exe	117
PID 1864 wrote to memory of 4972	1864	msedge.exe	117
PID 1864 wrote to memory of 6080	1864	msedge.exe	118
PID 1864 wrote to memory of 6080	1864	msedge.exe	118
PID 1864 wrote to memory of 6080	1864	msedge.exe	118
PID 1864 wrote to memory of 2064	1864	msedge.exe	119
PID 1864 wrote to memory of 2064	1864	msedge.exe	119
PID 1864 wrote to memory of 4984	1864	msedge.exe	120
PID 1864 wrote to memory of 4984	1864	msedge.exe	120
PID 1864 wrote to memory of 4984	1864	msedge.exe	120
PID 1864 wrote to memory of 3112	1864	msedge.exe	123
PID 1864 wrote to memory of 5792	1864	msedge.exe	122
PID 1864 wrote to memory of 3112	1864	msedge.exe	123
PID 1864 wrote to memory of 5792	1864	msedge.exe	122
PID 1864 wrote to memory of 1624	1864	msedge.exe	125
PID 1864 wrote to memory of 3436	1864	msedge.exe	127
PID 1864 wrote to memory of 3436	1864	msedge.exe	127
PID 1864 wrote to memory of 3228	1864	msedge.exe	129
PID 1864 wrote to memory of 3228	1864	msedge.exe	129
PID 1864 wrote to memory of 3744	1864	msedge.exe	130
PID 1864 wrote to memory of 5640	1864	msedge.exe	131
PID 1864 wrote to memory of 3744	1864	msedge.exe	130
PID 1864 wrote to memory of 5640	1864	msedge.exe	131
PID 4564 wrote to memory of 2024	4564	Excel Edit Formulas Software.exe	133
PID 1864 wrote to memory of 2852	1864	msedge.exe	134
PID 1864 wrote to memory of 2852	1864	msedge.exe	134
PID 1864 wrote to memory of 2852	1864	msedge.exe	134
PID 1864 wrote to memory of 2128	1864	msedge.exe	135
PID 1864 wrote to memory of 2128	1864	msedge.exe	135
PID 1864 wrote to memory of 2128	1864	msedge.exe	135
PID 4564 wrote to memory of 4248	4564	Excel Edit Formulas Software.exe	141
PID 1864 wrote to memory of 472	1864	msedge.exe	137

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Hesv.cizl.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Hesv.cizl.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3820
- C:\Users\Admin\AppData\Local\Temp\is-KRTN8.tmp\jaffacakes118_Trojan.Win32.Hesv.cizl.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-KRTN8.tmp\jaffacakes118_Trojan.Win32.Hesv.cizl.tmp" /SL5="$8001A,5774214,54272,C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Hesv.cizl.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Excel Edit Formulas Software\Comdlg32.ocx"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4780
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Excel Edit Formulas Software\mscomctl.ocx"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2240
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Excel Edit Formulas Software\x\sbls.ocx"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3852
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Excel Edit Formulas Software\x\sblc.ocx"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:572
- - C:\Program Files (x86)\Excel Edit Formulas Software\tscc.exe
    "C:\Program Files (x86)\Excel Edit Formulas Software\tscc.exe" /s
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2960
  - - C:\Users\Admin\AppData\Local\Temp\GLB3A0D.tmp
      C:\Users\Admin\AppData\Local\Temp\GLB3A0D.tmp /s4736 C:\PROGRA~2\EXCELE~1\tscc.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:5512
- - C:\Program Files (x86)\Excel Edit Formulas Software\Excel Edit Formulas Software.exe
    "C:\Program Files (x86)\Excel Edit Formulas Software\Excel Edit Formulas Software.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.sobolsoft.com/
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1864
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x334,0x7ffb11e7c188,0x7ffb11e7c194,0x7ffb11e7c1a0
        5⤵
        
        PID:5752
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,10157271367420283670,18222827673442018876,524288 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:3252
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1532,i,8157931383806765252,949082651157245391,262144 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=2876 /prefetch:2
        5⤵
        
        PID:1596
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,12603513680086846173,7233240719664683995,524288 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:13
        5⤵
        
        PID:5080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,4235089423295271102,4036224607481860912,2097152 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
        5⤵
        
        PID:4824
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,17608072843717470036,8356737942047590068,2097152 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
        5⤵
        
        PID:5788
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,15302902244139357080,167612036575089293,2097152 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:1
        5⤵
        
        PID:3484
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,13516649259235214127,5209755033818116155,2097152 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:9
        5⤵
        
        PID:4672
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5456,i,18401686709426090097,5005635832086827181,2097152 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:1
        5⤵
        
        PID:4972
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5620,i,15774353755846992507,2753668102004249514,2097152 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:1
        5⤵
        
        PID:6080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,14538201758198342110,6088630707196281501,524288 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:14
        5⤵
        
        PID:2064
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5380,i,4679229112696462636,8894031173252484718,2097152 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:1
        5⤵
        
        PID:4984
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,10032889641463341162,11884289518489662086,524288 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
        5⤵
        
        PID:5792
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,11530097163951617132,18257770638656118620,524288 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:14
        5⤵
        
        PID:3112
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,9775078652899898812,18021042296080682664,524288 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:14
        5⤵
        
        PID:5112
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,9775078652899898812,18021042296080682664,524288 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:14
        5⤵
        
        PID:1624
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,7963977476535133818,6303864229465424048,524288 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:14
        5⤵
        
        PID:3436
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4764,i,8450560840404646829,17288965438715991424,524288 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:14
        5⤵
        
        PID:3228
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,6652652375205143737,1972374006936379377,524288 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=7224 /prefetch:14
        5⤵
        
        PID:3744
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7284,i,5196487778876433284,11982935178234878946,524288 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=7276 /prefetch:14
        5⤵
        
        PID:5640
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5268,i,7410753221175543558,16229707542178883174,2097152 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=7324 /prefetch:1
        5⤵
        
        PID:2852
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7608,i,1030785825655584438,7450429836974298603,2097152 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=7748 /prefetch:1
        5⤵
        
        PID:2128
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=3688,i,13944169128856144665,4666768036898654464,2097152 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:1
        5⤵
        
        PID:472
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=3696,i,14644811081084970607,12029447603893299173,2097152 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:1
        5⤵
        
        PID:4448
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6636,i,6032849175385662957,6428184315428965043,2097152 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:1
        5⤵
        
        PID:1284
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5168,i,9639757753017358604,18159136756329589150,2097152 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:1
        5⤵
        
        PID:4248
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=3644,i,14691743353099694094,6731115462086196305,2097152 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:1
        5⤵
        
        PID:3408
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=3656,i,1201765271663065872,6117707940573185256,2097152 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=7872 /prefetch:1
        5⤵
        
        PID:1168
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,18079114418305861419,7981244502826950241,524288 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=7816 /prefetch:14
        5⤵
        
        PID:2080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,7628120345714828186,2055758721792311895,524288 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
        5⤵
        
        PID:5220
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,4212271409171482034,3875846794049946246,524288 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
        5⤵
        
        PID:5892
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=3320,i,11611728793284228644,12958336689482202855,2097152 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:1
        5⤵
        
        PID:1240
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=2744,i,18406349114171566471,18234531301378499276,2097152 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:1
        5⤵
        
        PID:980
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=2312,i,9956137411563598704,10408726553423397857,2097152 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:1
        5⤵
        
        PID:4928
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7532,i,1399429157400335700,13398633079208688015,2097152 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=7416 /prefetch:1
        5⤵
        
        PID:200
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=5132,i,12439361658504506572,8196497928707862785,2097152 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:1
        5⤵
        
        PID:6036
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7424,i,5053293087756392254,4893605449901995647,2097152 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:1
        5⤵
        
        PID:5196
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=5788,i,11256652485966839509,15394363537335114562,2097152 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:1
        5⤵
        
        PID:3036
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=5820,i,17677852579034466664,15320314218792467316,2097152 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:1
        5⤵
        
        PID:5560
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7108,i,11028309242392256641,12241766298288183284,2097152 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=1156 /prefetch:1
        5⤵
        
        PID:3932
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8036,i,7920862211186913395,10549162796558098507,2097152 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=8040 /prefetch:1
        5⤵
        
        PID:2888
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,2176203645884450409,9156629581696111111,524288 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=7052 /prefetch:14
        5⤵
        
        PID:120
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=8468,i,7114029059426360767,11888908273481856737,2097152 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=8504 /prefetch:1
        5⤵
        
        PID:5560
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=6828,i,9933997763494385503,408558918284259645,2097152 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=8428 /prefetch:1
        5⤵
        
        PID:256
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=3700,i,2082535412100584510,15918007711221198794,2097152 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=8072 /prefetch:1
        5⤵
        
        PID:6584
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=8732,i,4996826588794817495,17340673698912016582,2097152 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=8740 /prefetch:1
        5⤵
        
        PID:6624
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,7133119369218402793,6310420934416352316,524288 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=8480 /prefetch:14
        5⤵
        
        PID:7024
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=8600,i,11647595160895757107,6667832763627464394,2097152 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=8924 /prefetch:1
        5⤵
        
        PID:7100
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=8608,i,14925280412288392032,6902024305478141933,2097152 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=8628 /prefetch:1
        5⤵
        
        PID:7140
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=8168,i,13035909294132760153,17502717656432328007,2097152 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=8816 /prefetch:1
        5⤵
        
        PID:6564
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=9056,i,5512994130704746068,6962795058621036894,2097152 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=8660 /prefetch:1
        5⤵
        
        PID:6612
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=8572,i,9649190928130950536,12871584633049099542,2097152 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:1
        5⤵
        
        PID:7132
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=8652,i,6626594111578517348,18236419566111117380,2097152 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=8776 /prefetch:1
        5⤵
        
        PID:6196
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=8976,i,7729503037517505973,1140275257191840144,2097152 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=9044 /prefetch:1
        5⤵
        
        PID:4924
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=9408,i,1901325844735395838,17438860724888839899,2097152 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=9396 /prefetch:1
        5⤵
        
        PID:6600
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9536,i,5957772950862018063,13726462252418871306,524288 --field-trial-handle=2880,i,12297176935070593773,6884813288788215005,262144 --variations-seed-version --mojo-platform-channel-handle=8708 /prefetch:14
        5⤵
        
        PID:2548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.sobolsoft.com/
      4⤵
      PID:4860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.sobolsoft.com/
      4⤵
      PID:2024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.sobolsoft.com/
      4⤵
      PID:4248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.sobolsoft.com/
      4⤵
      PID:4104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.sobolsoft.com/
      4⤵
      PID:5256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.sobolsoft.com/
      4⤵
      PID:2844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.sobolsoft.com/
      4⤵
      PID:4548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.sobolsoft.com/
      4⤵
      PID:1816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.sobolsoft.com/
      4⤵
      PID:5728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.sobolsoft.com/
      4⤵
      PID:5584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.sobolsoft.com/
      4⤵
      PID:2836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.sobolsoft.com/
      4⤵
      PID:6568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.sobolsoft.com/
      4⤵
      PID:7084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.sobolsoft.com/
      4⤵
      PID:5316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.sobolsoft.com/
      4⤵
      PID:7116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.sobolsoft.com/
      4⤵
      PID:3016

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5028
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:5500

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:4932

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Comdlg32.ocx

Path C:\Program Files (x86)\Excel Edit Formulas Software\Comdlg32.ocx
Size 137KB
SHA256 46f4fdb12c30742ff4607876d2f36cf432cdc7ec3d2c99097011448fc57e997c
MD5 d76f0eab36f83a31d411aeaf70da7396
SHA1 9bc145b54500fb6fbea9be61fbdd90f65fd1bc14
SHA512 9c22bc6b2e7dbcd344809085894b768cfa76e8512062c5bbf3caeaa2771c6b7ce128bd5a0b6e385a5da777d0d822a5b2191773cc0ddb05abe1fa935fa853d79d
SSDEEP 3072:VESIiWD8uq4hCqUt6mqD1gRshBgH/voqJrwo2CocrJbQN6N2TRqEydzXS0:VETz566VgRyOJ0oDxQRHf
TLSH
T1B6D31A9273F66222E4B73B302A7A27A06EBABC515D35D50F6710724D0872AD0DE74F27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Excel Edit Formulas Software.exe

Path C:\Program Files (x86)\Excel Edit Formulas Software\Excel Edit Formulas Software.exe
Size 816KB
SHA256 1b61b8706452d03e3a11bda0d0b4fdfc91ce6d60ae1b20d3c8b23db8a6f67f65
MD5 d815183d047deb472acf863cecf53072
SHA1 027c44d4e6fdf47fa585bdcc34948b891ca7996b
SHA512 127b9b9611cbf9bcfa1f841386dda07700dfea316d1a608ef5169cab72675311774f4c5848065aa22987d2da91e2a03b10ee8e716de57e0b18d970745a85ddf3
SSDEEP 24576:s4SErrqrnrGrrwrrWvrDJPvrDx4SErrqrnrGrrwrr:7
TLSH
T1A505D6A31A6652DAECEC8CBDC53AC57206222D339142467B62D93F2F3BF14C152CB756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HAND-M.CUR

Path C:\Program Files (x86)\Excel Edit Formulas Software\HAND-M.CUR
Size 326B
SHA256 87bfef52971132ff30f7713898a8e729e6f54976eff957e47507f14469455976
MD5 36af4bd3e963bb6d681c3e043c06f504
SHA1 7a1c7a8646f6e47f38dfdd3874ca90c05d52507c
SHA512 6a6a4780b82b5539c6abad1dbd94c562e0e67250639649acbb2079963af8e740a6fd02e5717b61d4b21c5c06d16055e2cb55c052281be4fb706ab625ca8d21c8
TLSH
T109E0CA20B038D081C0C40ABC8A27CA920658AC9F184426022A60BE4F7E383A2AC20024
MD5 SHA1 SHA512 TLSH

Submit Download

sample1.xls

Path C:\Program Files (x86)\Excel Edit Formulas Software\Samples\sample1.xls
Size 16KB
SHA256 2e9f95d1eca9594a3ee17426cb7de2ad335ff0001a7860773eaa983462bf9855
MD5 b4d840a89f475cc73fce70dba60cffea
SHA1 d54b0aeb3f23b3852820b2b2f7bbf3a61dded2a0
SHA512 cf1def89e55e076ac65106d4ceb2912649bf6fab4ddac4b41fea25932ffbc83fe202c25b18b3105d4a59f18ed1111b058db814a36db07728db605780cd560f5a
SSDEEP 384:iI2ETvZ+RwPONXLkRyoDhIcp0fDlaGGxTqcLrK6zrApsqlsljl:iqDZ+RwPONXoRjDhIcp0fDlaGGx+cL2O
TLSH
T1DF72BAE7B7D5AC45CD49033548A783A06627FC216BA7978B3389F71A1F72BC08913617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sample2.xls

Path C:\Program Files (x86)\Excel Edit Formulas Software\Samples\sample2.xls
Size 16KB
SHA256 47adf7e9be8676f81f7b2f82bf3cb7578acb95181d473d7d0707f9ff163bb184
MD5 a2ac24bc02c56794e431f793fcc5ac0a
SHA1 c57086c9666b0c79be9541fd7ec1309d2a4b5449
SHA512 5c1db7b5cb3b0f00e1d97fc7afb71a0beabf6fb91fbf14186c094e590cc9c6a086df172381d7861c3be04c7b898332d665b0ca3deb6cb4482416bcc63fb60c0f
SSDEEP 384:Gk2E4uZ+RwPONXLkRyoDhIcp0fDlaGGxTqcLrK6zrApsClAlbl:GeVZ+RwPONXoRjDhIcp0fDlaGGx+cL2C
TLSH
T16472BAF7B6D5AC05CD49037548A783A06627FC216BA7978B3389F72A1FB2BC08903557
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

How To Use Excel Edit Formulas Software - Reduced.avi

Path C:\Program Files (x86)\Excel Edit Formulas Software\Video\How To Use Excel Edit Formulas Software - Reduced.avi
Size 15.8MB
SHA256 8ebfdbf189369aa4b9538a91085933ab82ad1f536277b56bde7ec32e5ac72864
MD5 46ae16a77004e5bf08a3119e3ac5cf5c
SHA1 60b9cd2ff68deaccd5da53e6ca5aba9e0b9285be
SHA512 921b93f8258c21010c4949b25794223076b05b5b6a195385ea601d07612561833f63f06a9d7370d72966c253bc2f5351a95308fd032dfabb54d554139bba33c8
SSDEEP 393216:HttNbJbv5bVbVbvbGbVbVbvbCbVbVbvbKTvgDi2BXUk15POzN:Hz3+gDi2BXUkHPOzN
TLSH
T1DDF6E1BD01A84062CF9A513166AF43D3BA53AF4EF51C2875FDE8BDE0ACB40176179827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon256.gif

Path C:\Program Files (x86)\Excel Edit Formulas Software\icon256.gif
Size 21KB
SHA256 4a94edb4c42c904e072df9f64f67bc1365287a25a901ccd5ee10266753c38010
MD5 25fed95fe961b448a4b878d1941041d4
SHA1 8a40dbca1cc9a00fffd52ac3dd115540ea3c5858
SHA512 a65d02e2f715231ae2f491bdea20b254368a5b28c19337444f0b8618eb7d72e3cc89cea0d11161fc98d686aea23740541666f4ab102c40527ebb2e31eead46ef
SSDEEP 384:gaIOj2D4EQvx9isEjCVHfkncnH15ZbDmmYS4uAK03INyU3TePo2Q0:gapc4EQvisOYkncn5D55ZyU3SPBf
TLSH
T17AA2E12B9E97679F44288219F144A1840076565CB4BC2ABCF1ECC84BDAF55AB13FC7AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mscomctl.ocx

Path C:\Program Files (x86)\Excel Edit Formulas Software\mscomctl.ocx
Size 1.0MB
SHA256 bc58d624ceea02ab086f1cce809c992bf5a7105e88931853317a2f5aa5afd6e4
MD5 ecc7d7f0d3446de36045d1d9e964fafe
SHA1 da6b0ec081d628c33b150327f3bd16d3b7fa4729
SHA512 443de697be9886cd97235e6468f3a7f6bf11612711e54dba31431b0d9418672e1434e839ed50cacf28107f692f0c9d9d2f57d90e3a843d81015d459c180db632
SSDEEP 24576:s0LiK1d6dxOehwsj5dC33M/jYVRDSfaF0gg1CVGO7oVtNKG:n6dAehwaY19G1u7+Ln
TLSH
T101355B0273E58022D1B726B0197B37B5ABB67F619D38E94F1B503A0E2931E81DE35727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tscc.exe

Path C:\Program Files (x86)\Excel Edit Formulas Software\tscc.exe
Size 169KB
SHA256 fb049f47abbc559e6eff46ee67ad6836cee7c82cb3559742b75c1774894e01c0
MD5 df94598bfa01136951b4221611af4db5
SHA1 fd1e48c75e6e14dd48590dc5718d4322535b5b7a
SHA512 2a2e3cb2145149b247c98828c8fd5fb72f4eb0b8e173b0ec1ed7b647a32a38ae8c69d07ef12c0e634345371b50e6db333064e75664c837f9a6f11ddd5730b3e9
SSDEEP 3072:zsJ6EJtqNuYDvFebKpjwd87vNP2R2d7BdXvGwB/Z8YhS3jBUC+5QyU1:z4fwJDvFeKBw8v92A7BBfRuuh5QR1
TLSH
T1DC0402670AB13FE2E5586EB00536F219CEF6D7342D90895B0EB01D0E2D256DE6F2660E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unins000.exe

Path C:\Program Files (x86)\Excel Edit Formulas Software\unins000.exe
Size 698KB
SHA256 c32aefa41d46963eb42ff6a8237a9b97d00c62b2c069ffbe56f5823c29d5d22f
MD5 deaaa6c730560569e4bd295ea7761fbe
SHA1 c989d26041dc3facb39482e7c8c4df27f8c86fbe
SHA512 e6c6a0d359322f99d4b87d894a2cfe34cfff80f77616805dee83c98671d0b1800028a55d21b3b2c3fc5b35c1b3cfb4dec7f8cecd2c6a39d93aa9b366db36a963
SSDEEP 12288:QRObekMtkfohrPUs37uzHnA6zg5cIsalHERjUrNN/RQ9wgUT5EDExycb:6ObekYkfohrP337uzHnA6cHswHE/6gUL
TLSH
T168E47C32F2A08837D1B31E789D1B86955936BD103E38A59737E81F4C4F796817A2B3D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

o.cjs

Path C:\Program Files (x86)\Excel Edit Formulas Software\x\o.cjs
Size 529KB
SHA256 b097cc6db98c456381b1c2f5e4827dde3480c2f0e9561cae81d33d5efd8104ed
MD5 663ce82c52435d68e20910f6a7252725
SHA1 ef6719db6ec6209dd832d0a336ddccef87343a4d
SHA512 86be243024e0c055d13516c8568090f3fc5347fd0d6764be8c64f08c753c1f3cc4db00af5c2746e97c74e2f01292b5bcc855a2b94b8cb95cacfd53dd66b28fa0
SSDEEP 12288:JDN/5k4u34yKisgR4Jfi12XPbbPzNq3dEAPc71j53dEG:xk4u3HJ4qNEh5NEG
TLSH
T172B46E4277EC0059F2FBBB74AEB940719B3BB89EA93DCA1D10D1140E66E296059037F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sblc.ocx

Path C:\Program Files (x86)\Excel Edit Formulas Software\x\sblc.ocx
Size 1.7MB
SHA256 0c9e0d800c941ac780c77f105b3cd5641aeed56e40aef1c6e0e26b607a7a899c
MD5 ce01a4dba630802c3b57f5c383f0c418
SHA1 1a6c2f58a0870d3dde64eec668404a328c135fdc
SHA512 479defbb1b7b2b7b389d7dc70c0b902414925243fa55c62efba8ef019459c54074d81dde183f91dc2410a52afba29fb5babf43a3585e5cc57016ec133daa1efb
SSDEEP 24576:l1FVJ77Sr00N2tq0/FyQ/iiKW3ITAgdwBWKYJ1qLbXVLlcFruE6gy:lLFxFPAxTSlBgrppy
TLSH
T100858D11F9DA84F2D60C2634146E7B7A8779DE8ADF148BC7725CFE6D38322D1943224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sbls.ocx

Path C:\Program Files (x86)\Excel Edit Formulas Software\x\sbls.ocx
Size 545KB
SHA256 b3d054482d112e595c19a8d10d71d231217b0ca5c209db51e8114f55ea2de8a0
MD5 f5dc31c9f74358c3121eb3b55bc301dd
SHA1 752444e4c78bb1c7e9a3de0b5694e67bdeb25d7c
SHA512 b9d114e5da392db735f1ba63088412c00ec722ca52d4c47f7076b3bb70d58ce394471b703ca77c8c31c7b635804a44060560cd22002c8aac55c121dfc6bed0c0
SSDEEP 12288:DLZSoPM352YYfcGtFx6DHTxvu7BiZ3w43i:XZSt524Gt7oTM7Eg43i
TLSH
T1E2C48D42A69680F2CB9D143915AA773D537D9E8D4B3ADFC39328FE7D18720C2913934A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0dad4cbe-7ad8-4e65-b9a5-939dae4f9357.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0dad4cbe-7ad8-4e65-b9a5-939dae4f9357.tmp
Size 37KB
SHA256 1074ced57ea76f5cf261d33d9bad49553f08eb58a16ececdb360b5f076a96b72
MD5 4943f035824f985800f05508fef94697
SHA1 d3ccd30f2a13ffde1da45062324feef4505ea9e5
SHA512 0f770028ad4cf220d894d4fe166b00b194e524f935bd9ec34faaf2efb9eb1c9f8a0a79d54b2d9271dc835ec650d48e4111e105ddbb671e28b77d9fb0d336b567
SSDEEP 768:R/UxvxjgC+W3gL3c7fZrK6p5XSwQs88uBkiTCc/P84g:kZj3+W3gQtrtILNBVHg
TLSH
T1B303C039FC945863ACF793853B5A275BAFF05053C4C41BA889EE7A0E028B75D6307897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3f2a7350-595c-4a17-aee7-808a3d9d7f7a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3f2a7350-595c-4a17-aee7-808a3d9d7f7a.tmp
Size 38KB
SHA256 da7919ce042f8285a55d994430783af9b11f8b0d5a65ec0afc6586b21343ff28
MD5 c1943de27163d74ed2e4d27c5fdbbfcb
SHA1 597999e4eea58d22ff563ce9d3d8fed67a8ebe44
SHA512 d4854a858bb888b54f904a9bcc89a441852db091f2be1547b78ca4a4c8fc7c44ffddf8905b4fc478a12b1fa65e6cb53a338b74dce57fca2bc58661302c23b0d7
SSDEEP 768:X/UxvxjgC+W3F1Hlc7fZrKHp5XSwQs88uBkiTz0/P84g:KZj3+W3F8trEILNBGHg
TLSH
T18E03C038F8949863BCF7A345365B275B6FF020A3C4C40EA88DEA6A1E028775D2747857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67efcad3-7ce9-43ce-9372-33cce619c7bc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\67efcad3-7ce9-43ce-9372-33cce619c7bc.tmp
Size 33KB
SHA256 34d702a5447a1313fba84d041cb59a62120cf4b707251809cba076ce1d1d83ab
MD5 3a8f21c3dafe5893039cb84a73720bea
SHA1 033dee9fc9b2e06f6285587c36cacc9324cac765
SHA512 3e917048408c66854099fc828c39d85b32994eb04e2dcc1058eff70081f324d483cd90605b8b4875a04d5b80a5213c066793159d26cbf1dc6dc02a99ce69d2d1
SSDEEP 768:sC3lpEHXc7fZrKqp5XSwQs88uBkiT20xTJL+:sC37ftrdILNBlbS
TLSH
T128F2AF34F8909D63ACB7A342775A37466FE06157D8C40E58CADAA61E02C339E3B47C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a0b193400a27c0cdf94ac11f5fb5b0747828b5b461169cefeffb96191b9e4834
MD5 edaab58c014c1abbfa900853b2ab2696
SHA1 e35eb02c0343d109af1ddd7dbd39dee3b989aea3
SHA512 b3cca7ed39fd4708b9c01cbefd67aab972f585372e01b5fa39d4a0840a7f579725d1202ab2916cda4e7635fb16dbc74178888461c7b6a2b3ea91d273ce2909ea
TLSH
T1BBD02B75F96ECC23E85204F940D24208329775818C0441812601CC080A603850000182
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 932f01682de6215b2c3b5faeb96a07b886e28db2ff6f8242a36da556c4292464
MD5 667b54168424526a7188593696f59ace
SHA1 deeb9f5ad1bccaabad57a386f08ba0c0740b2f81
SHA512 698f5a88d262c546b9bf21ead67e8dbe00ce6bd13f196761a5910f59ff69ca7532cacdf03c070f8d3b9f5d4fb8990b358e9b60ace9e48a0848e4a9da1d92b3ed
TLSH
T1D4D02B79F95ECD23E85204F540D1420832A77581DC04418125018C080A603850001182
MD5 SHA1 SHA512 TLSH

Submit Download

0384b9c5-815c-4f9d-a76d-d0b321e41e78.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0384b9c5-815c-4f9d-a76d-d0b321e41e78.tmp
Size 12KB
SHA256 7637dbd43218612372752616472d50942d74c9242f8ad522cd428b9d4348b2b7
MD5 a3a98131478078a62fdc16c640c104f7
SHA1 25008f3b29ed4f6c2031c012beb22e6edc6c879f
SHA512 472d7b3a8576dc3378f56b27eaf1a0d963028b1565f698585ea696d27516e51ece20bdcf73faa9d7862d8bb6d17c9da133e607bc27cae2abd9ec67db7d321172
SSDEEP 192:sxR+RgC//fssIy5ZjFojzoA8p+x/g6+WNjVihYEHDEG7IgDUdHJ:sxR+9//fssFX16/58hL2p
TLSH
T11C42C715AE28A93B8CCBD31DBB557F53D2F91033A1C01E48A6FD9A1C04E76DE620781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3f422fe4-e512-43e0-af66-b7bafab82efb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3f422fe4-e512-43e0-af66-b7bafab82efb.tmp
Size 29KB
SHA256 8c5ac8f860ec1c6d0163d4f6ddbdef48ae13eb9aec21ea1703b561accde777e7
MD5 cf01df29db213ff7ffde870087a615c2
SHA1 5f8a653692df603488004ddc5849ed00eb2fe4b0
SHA512 65448bd2eb61749b9f37375ca2b29ef29b55001bc948c5bfb14918a535dee535683b9dc2f9b79c2649baca0e10496127deb3447a0cd3c1810f4138489b323e85
SSDEEP 768:U/pCox7pLuLbLmWg8KfrL8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJCuyhpBroJP7p:U/pConEbLmWg8KfrLu1ja+Cu8p69V
TLSH
T19ED2D97B740CCB7F4F804ADDA8197A9B6DA902CB9698CD4047FE941C02C77EB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00003d
Size 92KB
SHA256 4955da4f9cefc12bb2c55948e074970f17bf4201074e042b866f132b0e68b148
MD5 b3549a3fc5e7e05e2fd91047167bfb7d
SHA1 3fa78a2e0215056f2e5b630239c38781b2c1c029
SHA512 31efc0c50a4120a14344b9a66451246e76fd4fe9ee9b9c7758e2a19a9ed2df3d7fcefbe5328df9e599294b2b82bd9721a63e0002019679b1390b48e3e8c83b0b
SSDEEP 1536:janW8VefZrZLZCU6RkFg2VX5QlH5QF1fIVbagoEVizZV508Tsd6yjv3Zwb61+mIo:jgjG7LZCwg29m+IVbaGizZv0tDDJwb6/
TLSH
T1A2931205B0CE731D35B1136F4A83ABEFCAE448DD459474D86F21AB3C6C3696B84A847E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00003e
Size 1.6MB
SHA256 f18ee443b52537fadfa222d4bc0c7ee6c85a699272178f12f349994811cb86e1
MD5 63fcdd3ad3f75f5d54c45c3825d118de
SHA1 4f729ebf8c126356760bd3446b4b6847d2de44b3
SHA512 53104394fb6409c237ddabe148c745d890523d792bb4eb340f0740abc7eef32189a5d17929702ffe4300c1a3fe0021c3f56c117b9e5c450c89bb4b62247ae7a1
SSDEEP 24576:KbCTR/weItSsKoFxFm1WPH7I6MJbF63TZMkelGVH2X6VO9TQXBH5jZHZ1p0:zqx0sKoFtEbIItCOZqH5jZ51p0
TLSH
T1B87523F7B436CB41C863B2BC544A1A250E942B26B7622121E573E61F637CD74862EFC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00003f
Size 17KB
SHA256 d44e12533659d6a60cdaf07bf7eaa116277006b9b2ef8425a8d3d9e294a87aae
MD5 7f466774c49b3ae646aeac8f9f9d63ae
SHA1 c124c5ffe026ad23036696984e97a602d98964ad
SHA512 f91be060fb6b78c306c6bf8d65c66dcd59d4c3740d20d0df350fa1ff06230c98a3cf215473a405e7efea82044d211c9ad791bb1b2eb9f42db0e5278150eaef74
SSDEEP 384:Vr36VHoTn1A9FpAP6hy6oV4DuTeYCk/5GC3/spSm4RUpTUGfPika93Plyr:t9nMAyhEV4D5n25jtmBTUGfaFxlQ
TLSH
T10C82E2952DD42991DB4B7E634766EA1DC8DCE7300C10E1A3B43BB3375BAF65874B408A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000040

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000040
Size 47KB
SHA256 3100e775e8616cd2611beecfa23a4263d7037586789b43f035236a2e6fbd4c62
MD5 260c81a4759baf163c025001c4f27872
SHA1 f11d729bb0a4d8350d2ea3d0fc062cf6ef2d5298
SHA512 9acec3e7a411a1eb6d072c3773bb14e5aa74d85d334674ec0fb018b7937174d5b612b756b2ce7aa3993d31dfe172516e7aaec79c7dd209eac5fd15d9aea077e9
SSDEEP 768:Gp4Wb3wv+eCLRZRtq9uGHpHveBOX5qw/14X+5edVWK4afHSTle4MRhVUNMT/TQDt:Gp483wdmXRtqhJPeByj/f4WK4mHIj8xw
TLSH
T1BE2302DF9E4D72D29271267045338383798E2D8A50AAE7A1061C0FE6DE05B69D31FB9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000041

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000041
Size 356KB
SHA256 bc46fd21775b8ee12493decd8e5ded5df37effa89b4b9795e991f53028905a3e
MD5 7eefac66e95912198978808dbd4e02b3
SHA1 98decadaaa64a285ebec34ffa20b92fb4defa40e
SHA512 b195a3f56f2c67a117773f19f5fc76437117c352f1b63dcb66af2341812fe533fcc60b0a331e36f9a51862ff6e8a230eb780be2f76c22d430f5f2ca45d631b05
SSDEEP 6144:KIl5JkfTOCngvNdYaGEncaI2WQQVAcP9yVINBJo6GljhUcpxfdG+JZTsCulNqwiz:r5C61dYaGraI2WxVAQ9yVINc6GljhUcN
TLSH
T1A27423993BAF108DDE2564CF6161108F2568B9CFD368A58F496D08541AF3CEE31AF6C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000042

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000042
Size 56KB
SHA256 9e948d5ccad23ba460af7278c2d1f30227eae12a24c7fef09cc4e3972c0a23f0
MD5 62440436f865359a0fd19bb884bcb3a9
SHA1 5b3be8bc1df2f84fd95491815056bf53e47d4fee
SHA512 180b3cbe0e74920e0d43538c2437e3a17891048d0ca46db5b2a631bfae0c0b832b57847b707f985ef005f43b52d688afa99639ed5e3f797dbd079d7706f7420d
SSDEEP 1536:edCdvcd6/b7yV8mMcHCesUMphPlHd64ziLlqy42y:edgvcA//kMcHtBslHd6d42y
TLSH
T1DF43F1D9F5C55981F6F032A8AAA3FB03E53A3BB28F819F34F319D6C8508A5553207D06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000043

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000043
Size 62KB
SHA256 a34f57946811691ced8b34ac8fa92d3adba214313d6eca10d0f51dae0b883dbc
MD5 26c3140372bf7726a4192eb53fac89fc
SHA1 321b5753e76063e0349fbab34539634f91db7da2
SHA512 f439727e4563218fbf72a089f6a2f8cee8da105770f227cbff3a959617659a094eb92eaff12cabacb2ca5bd561b3e4f9197c44f9f489c4cdfa3ea81f3794b465
SSDEEP 1536:IJomv0p2ppGIA1GLaCUCVseb6UYg0e5vFWsDhwOCGAybAMJdviKsJ:IJoxIGGLazCxb6bglFh1wHMJpw
TLSH
T1155302222F803BA206CB7501DD68DA4D23F2061054F1F20EBD515B8668F9F752DE9DEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000044

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000044
Size 62KB
SHA256 5e5e85d099b6e305a65c40e5ed90b4530d656b4667e653055eaa58fe629bbef8
MD5 0e8c217b53bb404ec0691a1614995ade
SHA1 174e043de696dccf1e52c200d87e770c8fac8cb3
SHA512 0c5c890cd1250dd6ce3c7e0892b0c21417bc779cd10ef23e3e5f52805db1be63be95cd2103bcf39d4ecf051ce85d84bbe0bb5ef7fa22bd3dd6319e7e69ea974c
SSDEEP 1536:UWzW+x/64ORvoZ9Aj8g08klRRUNkQUSRuUqF771nAwlDkvlHSnzP6:Ua5ROkvgef6NtUkbimlynm
TLSH
T1FB53029DE9EDB9A7A590FA757C2994121E498C74C810F1FD00DD0AC81FF2F7A11726E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000045

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000045
Size 25KB
SHA256 dcdcf22423ebd398ae68ecf9951422f2aa075de0a442e9cbec1a830e2eb7c9cb
MD5 03ff171a1220b1c96169ffe2d374a76f
SHA1 7642e6049c8c43be75c158c9ba5dff0fe0234f53
SHA512 e211be42102c6d2cfe5cfee3692c61f30c4227687a7fb9393143b927e7639569d524175dbc4aa6729d65eb96378a437c054a77020d4baac7f8a0867dbd1c105a
SSDEEP 384:gyzZISxmkmK/R2xrMg0ZTwESgJRNnuvQr2Lag3Ucq+CRWWsE/9g/tDal+S9VQ7SK:9zZBx3MJ0x9ROagkcq+eWEmS+LWK
TLSH
T1ADC2F0A6D514C8CCCFB0B66ACF5D4262FC49CB64AB5038EB6C114008CAF456CAECDE4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000046

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000046
Size 22KB
SHA256 9c33980aef93d2491d67e22551e295c986a2819c412893a0f741415c6c9cd0c7
MD5 d82635d3e2d2693d9d2388ef0eff6160
SHA1 a10c46d098f01c60c6bcd53ac18e2c2052ef4e3d
SHA512 56d2db0ee320bd2348f2ffff5f83d82534eb1d86fa52c16ee1708e41fba38a1cbbee9a583a0100a575355f219b06a3426a827d7a99023bce3e9bf004a8663ed5
SSDEEP 384:qXE05q2KQ3vssPowljY2CEoWGmFNJyuvSVO0jH4kpU4rSkDD4qzwJbKc:Q357tF5TCE7GmFfD6VO0j5U4bDpzw4c
TLSH
T1FEB2E1D71F62641EDBED3CD7BF9712974624A06ACBD871642DA044C3059291B0E9A07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000047

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000047
Size 57KB
SHA256 5f331bf0744e0f0f8ac2b3ddf353ef4004e1789ab5f5540bfbb95f7e06e3a9e2
MD5 5f29ac42076dcbf361c7d877e1f79592
SHA1 4364205c72e1f55b11c254a8ebb9bd505ed4f10a
SHA512 ab83bab16a9df83ae00c706ecab5cb117a02124263cb822498dfa02a722a9386b3c7e50cbaa794b866f55b312ab676f292d4f107e54f42f95b25a361ae01dbf5
SSDEEP 1536:os15LSgozkPN3UNZoby9Scz6LoiHCqaz1CT3O2kV/B:PVSgUkKcy9Scz6cTZheGV/B
TLSH
T1B94302C3B7294D10742F6BA11D68C4D3C460234A8CAF2A426A5C99FE41F7973BE792C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000048

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000048
Size 22KB
SHA256 78ef67f21c809c77f4748900f9bb47b3935dc3d97127898499e1354b0311faa0
MD5 fc6d6fb8b724b10eb8575887a7988eaf
SHA1 64da70fb643bbcffdc5d5a6819ed41a4afdd0647
SHA512 9af64731fee58de8e21520f89f7ef8f38b83a239e298d1a83fd4522fa01fefe6879c54974ea92e17d0434c5d29879d271698c89679d7ab4bed43474e4311c6da
SSDEEP 384:3aMgZvjkbZPJfhWrEROWrR1VV0QFuo1YzodM0Vi+2KY7biWfIgXoy/4WpH:qZLEorEROWrlso6zobil7G3gYy/4WpH
TLSH
T141A2E03293E5AF10940AF5D1EDF3B38E25F4DA560B71E17C856609E83EAC5705EE0282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000049

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000049
Size 37KB
SHA256 8bf1cea2c0b3907e261c4f17f9f92b44fdb122445f835acb0a40f334441fec24
MD5 161f2dd9e049c9c91b6b56fec910e9ac
SHA1 3103beadefde6cecb7444f99ee691b863f5f1d72
SHA512 2dfdd5510eafccf2b3ae66fe6b84c4a2edbbc2ab15f38996003e96e8f175a3fc0ace9d036c3a714bc318bdd6881c1b2b43a86a3d06a97bff75bcf60d52ab7663
SSDEEP 768:cM9c14DRN626EA6UNN86QBeCOB40EZiUSzlzSFp393mbuYhs5GYDE43tdqc+xgdl:ncq2x6UNN8vBeCOB4nqzK93HYqPDEeJr
TLSH
T1A803F132F266F488C6DA819956BCD62079C3E8DB4CE8435D6CE1F128C75FFE41A5018E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004a
Size 37KB
SHA256 118326a95dbd767e90a76c39da99cf4717885930f0366ae24f8e7c1655c44cd8
MD5 daebc86b039e43bd7be58f6a10c58152
SHA1 ab4761ab841ed93400a77187c90ee44d2890aaa4
SHA512 f80e96cc27f6f39153f4a026869d8103bdf23f802da41649134dd892ce9db0bd78265b313b04db61cafb2ffad0524d4b3d04498e015bdbcd4b29a7ae012d8925
SSDEEP 768:Q35f4urdhrDDVBUiU49C4I27iM+urNmTi9R4GYBW8707egtDs:GRZDciUwW21+c4+93QGewDs
TLSH
T18703F19709B0AC7AF8D736EE4495050D86FA1F1CAAA42C4477B0E3DD98CAE3BC543C42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004b
Size 62KB
SHA256 fa6ba166d6fa7a4ed08a3715ddf402c8d7fc4c983d5a322764015d8bf4b13efb
MD5 458b247b6593577a01799d0d4504828d
SHA1 63918495a844bc6544747e02b34c8f204158ae68
SHA512 722c38be2025bd3855abacbc2da47d97e17e15bf1522432a0b8a6e3dedb29ab6dd1d0d77de35186c608e1156541db98466064e26be6c2c1175e4b603a4d4772f
SSDEEP 1536:lpSEMyDcHNrI937X2zv+9J1OeryEnu7aJC7S/jPjgwpk:jSIG27m9e+cu+s7S/jPj/pk
TLSH
T16E53023F314D6B515B0C2FCECA066096FD952E45391F2E28A99188C0BDC729247FA7D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004c
Size 56KB
SHA256 f85894a08cfb65b7449d99ac33798b270c06eaf967e3c111dbd661c6937fa436
MD5 df23a97ceab359b52be0371c6c03eb63
SHA1 46ea54743e320a1bbd4d6236654ad34a3743154f
SHA512 127ba14fca98fa277e5a1c3340f67dffa3d6a471980e268d93e0f9314dc23c5bf9de31ebc92dc13645d2894663e671e2ee4724c2b2348c5ddb9bc3ed61565a60
SSDEEP 1536:nOFHMBi0pOEhEA3/2LW7YBAt6r5CMVJeCTdNn:TBPpOE3/kW7tcCIkkvn
TLSH
T1FA4302F978CA5C279C1A3D5686753B50DF441D3D9E08A2B440782E63D8EE807B285BC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004d
Size 36KB
SHA256 770b53acefede35a546b3cda524cde4da87f373dc73d2b79d15e624952de9902
MD5 7ecc018653c47cefd86a229db32e6b3c
SHA1 1eee635b479ff8c54ce4715e8db51e692b0e6803
SHA512 bf6f84d22e69b0d9707ddfacbf757667c013a9471dca7edd8a9e3ad06ff873334e6ed859b119dda2c8756e5023355866296eb690fc7f23007360c16e394cfc87
SSDEEP 768:b9h5/sonIS1N37e9toeYXqzc/fFGUTpE8N0rH89TepAsQk+3XYZeVaUo:Rh5UAd6aPXqg/NGq6vrcpe2xoEaUo
TLSH
T15BF2F2452577F46923875DF254E28D13F2B4AF8044C9ADBA9CA3E2E44B75035F4C0B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004e
Size 41KB
SHA256 a18c450dd7d307b7f65407cb545e7d41c7694b632b23410dd56ed6d68c1dce85
MD5 6a8b56c79523df4ea8905919e516379d
SHA1 4c75a801f51dcd831cc48f3348cfa846ae908767
SHA512 f3569ae3a627154d015c3b27b433c0e249c6e0b35c26773086125ae7a1fae8d0dbe771e57f16607848166c05496be45705ec3f6361489288c76363a81802c026
SSDEEP 768:Q35yxlhsa87Iueu5u/ooRcvHEuu5hQGbtmGUQmrnONEwm5v/mlDPhOjdJ9OTdHpF:leafooRcHVuXQCRUQ1NzmQThOjdwHr
TLSH
T197130256B5F4A4645BC1BA448D4C02C61FA72AF4B68D3839E69448FB3003C5BDF9F549
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004f
Size 50KB
SHA256 5bbc4c255413f5770fea253deed8e822b021209f1e80daaf628522a32b0b0d78
MD5 e81db8aa761296ebd0e0b98ca5ed94c9
SHA1 bb0e4185f7fdf7e0c5169c648e54129fd4a1d633
SHA512 c0ea50a86bbc15a3e7fefc547f00f9494b53e73ffc3eeb2849c318f3bef87395b9767c58449618fda606122943a9786ba51e422d18e9f5fe40b0f63a3a9f6010
SSDEEP 1536:f5wvMIq8Zrn0MM9unD4KPIYsC1azB6dARQ/3B:favMINZr0MMYnD4KQYq4dZ3B
TLSH
T16D33F2D8FEC23AA148D603E3DF1A5510AD0E9A5C6B0F242B05A27507628ABDF1D74DED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000050

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000050
Size 31KB
SHA256 d6909d19b96da4b127f9a603b48f086291342e9658d9ea92af06662fc7284768
MD5 64f016972b3f48f3d44402db15fed61d
SHA1 d5276d7d2dab812144e65c308cf72c8ccfa719af
SHA512 c43f4de5e3d80174c90719e4933ae5643717a01fadfec4e7f0b52d047015d0be2a3fd1916f5d3eb5363e543b159993ffae5a1b5ce0e881208589c2f9e1c62490
SSDEEP 384:aei7/6LlcM1ReJso2ngUd/2muvSemkj/esatSiGl/WqKXVYMSVYgIMLRrkjJYbps:bijmHRTyvnmC/YtZMptM2LRzbpymHBDy
TLSH
T190E2F1E69A0B877F4925AE1B71150820E0E0C4972F237ECD2383D6EDDABB622CCD0954
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000051

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000051
Size 35KB
SHA256 abe2bd62a33e66d128f6c4c47c6ae3383b5aa9f2f128b83019a14515125264a8
MD5 d179747e0f6783ef80a1bc66f43f5cc1
SHA1 59ea0e49b458e865008363d7f146db0bc7a2fb40
SHA512 bc79d7611301558f8517011da8f745f00772601ecef0e1b4892e7ce63b27cd156948a2c65162a4985014f286b07155927c79b51c70617afc1780c49604c05ecc
SSDEEP 768:k/CIuozkYJhA4tQjhCTVNLOjowpExXc/IG1z4tRKXwmcF:urR37XtFPxwOo4tgXwmcF
TLSH
T1DAF2F12F53B206E49D50A73AED5F08B944FF0BB8A41DC1D2969E692D24DF9201725CB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000052

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000052
Size 50KB
SHA256 51fd354cc2e48f7931a93438a02ffe388fa20220914b46fbb8c98d1130549692
MD5 db61c98fa197960b3aae5bd92c3f9b35
SHA1 3a484d91623875a79972ba04de70e095c278cd55
SHA512 2315f08814a55d7ae767f7a0d5f310dfcd0e913550e460ef94a94e5558328c7ef30b0da287164937bd778421e63c99f765b7b150b9772a2b6211574bb9f1f8e2
SSDEEP 1536:iNSYZARzR/uSb2OBKFB6orZd87lbJCgr0:iNx6RzNuSiB6mZd877CX
TLSH
T1D13302CDB477FE8BE9B9F52945384683B112B8C1DE066D397C86F3482911A80B3607F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000053

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000053
Size 66KB
SHA256 d0753c72e33af33ff2eb5902dd3023cfff4ea4655d4759802d36edced8b40aa6
MD5 9d91c6d36d391c824ce8c3057f8c1b30
SHA1 6b685088c35a9fe57f8103aac1f6d0aa7eb41448
SHA512 855d4d044a91c4a6429ad93f9dad5c79ea0fe1263855f90e6d4f5b32387ca43d506ca4cd24f502f568164c04fdf036480f9b7067728c87a2c31136de137aba29
SSDEEP 1536:Y3+Zo9rf3TdfMbnyGEvol5JWQ95URrjqynuDL3J1jMHFsbg16mKIepOyj:A+Zo9r7AXWQ95GrOnp7mKIe4m
TLSH
T1656302551EA6CF1C19DEDF2EA9CC004D7DD40F4CC800D98AC86EF6D819C69BB94BB662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000054

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000054
Size 68KB
SHA256 a136f332c342d1caf674e92929be28cec3f6082c0c5b5671c0121ec36c109bef
MD5 06f05428dac491e8a569d0ec8a753446
SHA1 10019d360833e7f92d2be7f4c852be66edcd6bbe
SHA512 90f9b8252d496940ced602c32ab581168e06ddfb3e89b56cd050c3c9ae36c78c7c081e05927586596e88db0416816b65cd3403baa1623cc38acb7598ceed138d
SSDEEP 1536:owwwb8vrDtWfHRMZlhEsGYeHQkbqYon3s3CldQ1Y36kwRCOyEQE:4niHaZxewkbDcdQKwRC4z
TLSH
T1DB6302DF59244482387CF935C89A8964676ABBC443DBACFA10E1A5430307B21AC77E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000055

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000055
Size 80KB
SHA256 ad3edeb7873885afbd89adde41ca4ade765427a2f5306916aab93334275720af
MD5 9e68a6f5778426f25b4d35fe5f46025c
SHA1 41bb961f74feadd7bb8b95cc59dd922177f31ad8
SHA512 fd430dca6b059fd7a6dfe984dcb7409bb5cd237e8cfe5aae8c36b14043b5668accf6eae842601a6cbe8ab17729babc4b5cc29ee24203a6a3a95abb35b09ac2e8
SSDEEP 1536:PZleOyWZZbnqkB1Rqcf1NiCNnriXUkM0cSC/IWi9ZcoOoMoXSCAU:zyWZtlB1R5ienrqNs6Hnbl8U
TLSH
T1A683125D9E6385C757AAE1F5940EDC0C3C7C4F93B8251A3411B911382C2FF5EAE5D212
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

587b51b645668138_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\587b51b645668138_0
Size 338KB
SHA256 bc24fbf7ae1fbd6f853dc92937defac07e0cad617e115c29e7b4af60e49846c5
MD5 1f8d1932b0880f564c5d930c8637d5b8
SHA1 2848f3c79c933c629e7fd7fc8cf212c3927be8c3
SHA512 d5aaa5daacc06e55c065305136f8591230fc2c43227ef4154c4a05bbc253e6ea0e7a4dac6c3775187ed6cdb4973ab33c91758b2cf1b7852ea23e3029ffecc347
SSDEEP 6144:zjDrdnknZZ5TipwoOFmlumLlXgHY9kSBJ:HynZWpwLGk
TLSH
T1CE741B665754BED7CA3313B891938826B734458D2FC3D31B52A0B3352C592EA8EDBD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d2128786788e2bb3_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d2128786788e2bb3_0
Size 296B
SHA256 2139d5f13a21e0aca36b0f0c37d44fa06bcd64418e460f9296eaf5d1385777d8
MD5 3a3784b67b9c78232e249f15a26511cc
SHA1 12f7e1a09ef6f4425f7f96766b902a819f24e725
SHA512 dc64acd8860d6d3b5c6c4648e3369bb50955d64f7e414543e0f68ec7a0802038033851bc1c3ac5b3029636c45666ea8df219345f24d3e8176d676b1e432cd021
TLSH
T1D8E02B63D174002DCB030EFDAA675755A65195D68A8DD4D98000E4F676262739952DB0
MD5 SHA1 SHA512 TLSH

Submit Download

9a574d09-13a3-4b3a-8f66-58b705661cb4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\9a574d09-13a3-4b3a-8f66-58b705661cb4.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

054b0036-36e5-4543-a047-6dfd89e831ab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\054b0036-36e5-4543-a047-6dfd89e831ab.tmp
Size 4KB
SHA256 dbf831a8ae5fce81fa85d8abc6a73e8aac3261e4515a0754a3e79ed083694fb7
MD5 b635b36975cf05e8c1b40f1175ac7b19
SHA1 58e21cbe76f819f1a8599ce8b5292de4d0353160
SHA512 c986eeb892f0836900f04b4f8786398fc44439d27f3d865532018c701ca1d0b34bf4f005b6fcf3cf994fb117f4d5778d464ba4ff2e4776a080700e91273ee5e3
SSDEEP 48:YALlN2O5v5l5pM5mVaCCjhhnONzszQzs9foKsFnzEsUCKsBgmzs98wEscszsI1Vn:DQONn4QVaZjhB/snzAyu8wYirL1
TLSH
T1D191C0F3C3E9C62D8E015AF0A7146E2BDE5D0915832C7C5AC8D4EE5B93E30B2E141A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

34930c96-331f-419d-9ad5-8bbc0cbbdc90.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\34930c96-331f-419d-9ad5-8bbc0cbbdc90.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

68f344a3-5b3a-41e9-acf4-9db81a908feb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\68f344a3-5b3a-41e9-acf4-9db81a908feb.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 52a67a09b15a33e99d69250a699380c5047bf24732928d7598f81cce0631a541
MD5 6e14615ccf1b87854cc8b43febe67d62
SHA1 d5574583e5663b022e17489647609524c09c6c09
SHA512 7b4dbd7ff3ffbf45c19cc65fd6753d7f7f17919f84eea3f7600dc5075053555319251917354d66250a772c63e66bd7e7cb232ce92db67c67c52e9b6a769b2b7a
SSDEEP 24:Kljo/gjI/KPhe1qSmZryXCteRkdIRNO5ktIfKJh61+SUTXyXHCOsVfZ003rwnfs+:KkYI/KpeEnyZaISyIfKP6oby5uInKf6T
TLSH
T1EC913305356E420138FF2A5A40F8D56B165231B334ADE97F7BB851A64DAAF012DFC8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a4eec388-bbef-4fcc-b8d1-8404dde96635.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a4eec388-bbef-4fcc-b8d1-8404dde96635.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c578de18-eba2-4aa3-b3af-d2424478f87a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c578de18-eba2-4aa3-b3af-d2424478f87a.tmp
Size 11KB
SHA256 083e974cb2dbb225a94536e9b75f919a7ad80f872b4669dfa16a500dfcab85b8
MD5 f74a331fb0a78802af6373cb0854aa2f
SHA1 1ebf4b9b97331743df01a57654074281dc7f530d
SHA512 e1d634bb6489b7e4373fa8281d58c14857006704335d847c7e17ac4a261f161bfbd4b717f646e12e607ddd882ff2afe4980b6f2f373792726e549177905a17b0
SSDEEP 192:sxRpRgC//fssb5ZjFIjzoA8p+p/g6+WNjrxZYEpdEG7IgVXJ:sxRp9//fssbXt6/5RZPX
TLSH
T1DD42A515AE28A93B8CCBD21DBB657F53D6F91033A1D01E48A6FD9A1C04E76DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbf3f5ad-5770-4787-a9b2-629e2801fda2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dbf3f5ad-5770-4787-a9b2-629e2801fda2.tmp
Size 12KB
SHA256 dbb0e69e5028b0e20279c27fa9a7d37fd7dfd70551f8ca799e423d2030e9fb26
MD5 18926b5deae5d99b5b165682b2ae46d8
SHA1 614fa984f5b69159a21d84626fc87beed3f3fd14
SHA512 254faa3a0e55b2dd71db32de403909c70e7a37696f4d6bfbc382a3efc2ae8144fa55b74cd7956ec63610c891abfeec35a5bb73f63af57867dd441d9bc6133e77
SSDEEP 192:sxR+RgC//fssIy5ZjF9jzoA8p+p/g6+WNjDjpYEdDEG7IgDUdHJ:sxR+9//fssFXy2/5Tpt2p
TLSH
T1D042B815AD28A93B8CCBD31DBB557F53D2F91033A1D01E48A6FD9A1C04E76DE620781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e0343104-ac67-4732-b6a2-99857f02a6a6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e0343104-ac67-4732-b6a2-99857f02a6a6.tmp
Size 11KB
SHA256 aca9c8746efc90ccaf48e717d93c9a8195ce365b567c59039766bbed0883eb9d
MD5 20d91c1a21205dc8817c0b82f1a30dc0
SHA1 ab8ff3041d56d57149a5b1d4063cc7a92b449b58
SHA512 365d340df3d9fbb74349ae6446382c39057b3022eb9354bd2d1444fb467fdd3a68cc536bb15a929db58d606fce45b1a81c7f965267ff460c3caa5b471318e919
SSDEEP 192:sxR+RgC//fssP5ZjFPjzoA8p+3/g6+WNjciZYE0dEG7IgDudHJ:sxR+9//fssPX8M/5fZ+Ap
TLSH
T16142B515AE28A93B8CCBD21DBB957F53D2F91032A1D01E48A6FD9A1C04E76DD620781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

19814202-5e53-4720-812b-12441ab33151.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\19814202-5e53-4720-812b-12441ab33151.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

affa3272-3628-4f76-b875-284aaf5b0d69.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\affa3272-3628-4f76-b875-284aaf5b0d69.tmp
Size 38KB
SHA256 90fd4128ba648bc3d370082f407d5c3795bb9f7a313faea1cc6486d08f8fc2ea
MD5 ba6953328622dad0d2e6698f47e37f29
SHA1 fa986d26e8b8c0b41b3f36a9fea0af018bd2ccfa
SHA512 1d8128815342f09044a2aab2e88df94638b63915ab120b81c020594c140da99157a0b86fc3eedf73b73498727970f708c88068f3f19a19a3b3777cdd52e0c78f
SSDEEP 768:n/UxvxjgC+W3RpsHHc7fZrKlp5XSwQs88uBkiT20riV:aZj3+W3PXtrQILNBlmV
TLSH
T1CB03B038E854AC23ACF7A345775B2757AFF42063D4C40D688DEA6A1E028339D6747C57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67abc536-324f-468c-b9a8-2dc735dfee47.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\67abc536-324f-468c-b9a8-2dc735dfee47.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

05f48d84-9886-4779-84b8-081e18bda29f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\05f48d84-9886-4779-84b8-081e18bda29f.tmp
Size 132B
SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
MD5 8126a600a3d95922fb651e3a6f104f68
SHA1 e386add1c2c1d9ca74461e5ce0d1b271d689160f
SHA512 5a0e81111f0d9a0f7943b99f7bad8162de0d3f99fffa9d8f8ab466fa9c7c4249808bedfa6e4d26426bc2d1a422e2155900ba71adc222617a5f0880dc60b89a93
TLSH
T122C02B8F542E47CBBAA5152D42D40B3B4690CD60F199E6B449FA5640006435CC608C47
MD5 SHA1 SHA512 TLSH

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4a4ef791-5d65-4e13-83d1-a1d2fc362d67.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4a4ef791-5d65-4e13-83d1-a1d2fc362d67.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

fdcf328b-1048-4fe6-9834-07b0a4aefc86.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fdcf328b-1048-4fe6-9834-07b0a4aefc86.tmp
Size 37KB
SHA256 d0c970d58efe2393a61da4edcf5bb34a19cfb64e991205514972cd45e88e0152
MD5 8191925d7aedd8e0c95dd31b21b3ee68
SHA1 65cfdac07a3f7c4fcaa4a5c165dd4a1f67fd11d7
SHA512 324e19a4f0d95624c91bb882626f12ece0f5e235b1649ac0879f6440010554433d1fdad0edb37a329d5d1f4a0ae746cd38517f6dbf07cf6e7b0eac3b7968d7bb
SSDEEP 768:bFdi3LwgJpXH9AerK2bp5XSwQs88uBkiT20xTJL+:Li3JprblILNBlbS
TLSH
T1B9038D39E890DA67ACF79782B75A3746AFE01197C8C809D4DACA6D1D01C32DE2747C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fee7c663-9358-4276-8b09-b33c9ebad7b1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fee7c663-9358-4276-8b09-b33c9ebad7b1.tmp
Size 38KB
SHA256 8667ee5cf00e7bbf2b831334b7ec10b11927aa0cc1c349f0d66af30aa703ed26
MD5 af32c7bca08488003a9878959ef041f6
SHA1 e5065e681f2fee09a0ecd1837989bc8e7737575c
SHA512 613990982589058542e8d2316f3cdfb00a6a736811909de0fbb86cf71f1ca0cc2da7556ac09c24d8a88e189e6d6dcd5c2d28508794538a4b588df6c87f421a49
SSDEEP 768:n/UxvxjgC+W3gpvHJhc7fZrK8p5XSwQs88uBkiT20rEV:aZj3+W30ctrBILNBlIV
TLSH
T1B703B038E894AC23ACF7A345775B2757AFF02063D4C40D688EEA6A1E028739D6747C57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ff393734-7087-4bcc-a863-45ba365b5b06.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ff393734-7087-4bcc-a863-45ba365b5b06.tmp
Size 33KB
SHA256 117590806dcc952034897056f6b5893a75aa4a49bb7b387efabdec348057d652
MD5 370e9e672615c1eeec99b5ae95497843
SHA1 cfd575a3809cedada90161c2841f88019069396e
SHA512 ddecd8af78940acf50d46a573086124b0d18a67905911fbd84a7d5b73f91b8e8b7508cff370c611ff8573d38e809d2e2f7d2ab6739939428ded2dc2a187c3b38
SSDEEP 768:MC3gp5HJhc7fZrKWp5XSwQs88uBkiT20xTJL+:MC30etrNILNBlbS
TLSH
T198F2AF38F8909963ACF7A346775A37466FE06157D8C40E58CADAA61E02C339E3B47C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 896KB
SHA256 db5d5241c4c12fba7e8678536b15c251c1843d61cd31e6f81f21f0569cbd3ef7
MD5 657380304275abf5bf9b68414b6ff658
SHA1 0761d37d3550ab02825bf5d32bf3a40f00d78ebf
SHA512 e62a654cfe0c24272096866eee2e5c08da0f7e7f8081e5f7026e2890924ad36000559112ef1c3c16ce2b8beaaf9513d08603cb757691b907c1f32488cf12772f
SSDEEP 768:T0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaE:NZP2tFPuNnY4UmqEMioTaBacg
TLSH
T1C1154137D190B085CF2C71B1E5ED5F08BA23B10712E152465FB8A67BBA633C98D1B1E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 5fbca62d037acf5ea84a178f8c0ea43d014408ebd1c52e78ee42901a7587008b
MD5 446cb3c10b72e773ade30e483fdae72e
SHA1 9bf00c512a4e8fe30a2c9ed4a179bad3c525404d
SHA512 2f24f5e9c48e567b0cd9b5cc27087a345979cc19e5ecb80e5a604067aa662163c11f7bd9c44ec3a1ed01abe467f5ed7f3082f74b170d47ca39c7e22f36abcf89
SSDEEP 768:70aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaF:FZP2tFP3vqY8mqEMHTaBacg4
TLSH
T157258437D190B0C5CE2C7171E9ED8F09BA23A10B11A052465FF8A57E7A633D98D1B1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9e6d1aa1-58c6-48c8-82be-faf8aab598f5.tmp

Path C:\Users\Admin\AppData\Local\Temp\9e6d1aa1-58c6-48c8-82be-faf8aab598f5.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

GLB3A0D.tmp

Path C:\Users\Admin\AppData\Local\Temp\GLB3A0D.tmp
Size 70KB
SHA256 cee481bc6a15e71f092d92c0e9153a38aa45c2a26c21af42055aca11f304eb0b
MD5 5381ebfc057c1ec9e0469aaeb0ff2a4e
SHA1 66dba95101119fc62f209c30acc56c31a374c857
SHA512 86b0253780c7383dc22ecae79000fb19532d48db4d6af4a2df64151653fb20311a5b1f15b2c1bf238dda9f0a31ebaf13777126f901db6bf0e7fea36ea3296307
SSDEEP 1536:bgiiJZEE8QjsUX2Yq6huJkHYD8QNMYqqleYFjuKfMcXrP3wP1un4:bsJ6EJtqNuYDvFebKpjwdd
TLSH
T18663F11508F0AFA3F5E8AD715A30F01ECDD6D27938208AC71DB52D1E4A2A8985B37723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GLC3A8A.tmp

Path C:\Users\Admin\AppData\Local\Temp\GLC3A8A.tmp
Size 161KB
SHA256 a87f19f9fee475d2b2e82acfb4589be6d816b613064cd06826e1d4c147beb50a
MD5 8c97d8bb1470c6498e47b12c5a03ce39
SHA1 15d233b22f1c3d756dca29bcc0021e6fb0b8cdf7
SHA512 7ad0b2b0319da52152c2595ee45045d0c06b157cdaaa56ad57dde9736be3e45fd7357949126f80d3e72b21510f9bf69d010d51b3967a7644662808beed067c3f
SSDEEP 3072:5kgzCh4age/BKZ5akmUbe2Rm9+ORsUIlyR6J7ooLGA5:9zCuagOcZ5ak36pTRTvRKGA5
TLSH
T1B2F36D1E7554A23AC9D3843D20745B329BFF99341356A5D3DB209EEA7DE0AC2AD38307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GLF3CDD.tmp

Path C:\Users\Admin\AppData\Local\Temp\GLF3CDD.tmp
Size 10KB
SHA256 166d7156142f3ee09fa69eb617dd22e4fd248aa80a1ac08767db6ad99a2705c1
MD5 3b2e23d259394c701050486e642d14fa
SHA1 4e9661c4ba84400146b80b905f46a0f7ef4d62eb
SHA512 2b792296dffa4e43bc85295dc7691bd29762ce5d9d5eafaa74e199e6a8e5b24aa85d0a1b27776d4719a49b0d29abcf6f240746a209528e608b596b560e5a3b88
SSDEEP 192:GHil+IWcS5ju90M1hfOENXfzZ7kX65caiPEJd3lBD:J+Dcz9fhtflYqcaiPEJB
TLSH
T13D22A40A774149F1E1667674B02A7735E3B99CB442183C0BCB535B3BA976622FC3A20B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b494fe5e-4f7d-4368-9f62-870196939c99.tmp

Path C:\Users\Admin\AppData\Local\Temp\b494fe5e-4f7d-4368-9f62-870196939c99.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaffacakes118_Trojan.Win32.Hesv.cizl.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-KRTN8.tmp\jaffacakes118_Trojan.Win32.Hesv.cizl.tmp
Size 688KB
SHA256 c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28
MD5 c765336f0dcf4efdcc2101eed67cd30c
SHA1 fa0279f59738c5aa3b6b20106e109ccd77f895a7
SHA512 06a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891
SSDEEP 12288:YRObekMtkfohrPUs37uzHnA6zg5cIsalHERjUrNN/RQ9wgUT5EDExyc:yObekYkfohrP337uzHnA6cHswHE/6gU3
TLSH
T130E47C32F2A08837D1B31E789D1B86955936BE103E38A59737E81F4C4F796817A273D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1864_1597824614\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1864_559224986\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 ad87180950fbb3d2919400c8c9d67c07c0bbcbb4d74d921e322f8d553933f030
MD5 edbf947f2463145f88aa89f08ec0cfa0
SHA1 1f48147d32773ed556d8ef6744cf997e735e6686
SHA512 5929d5e1936897128cf0262da00505e0ab4a55e0f5a4505c8d522a66565de66c4d155a127bd369f498c3665ee5e8d75d2b07956851c18da8f5a8c96562b204c5
TLSH
T191217C574A0AE4B5CEA287B358CC8A2773B6A7DB5364D015B3CAE01E880213E173D17D
MD5 SHA1 SHA512 TLSH

Submit Download

temp.000

Path C:\Windows\SysWOW64\temp.000
Size 100KB
SHA256 90a4fbf97f24e7e29972b97aebcc558c83dddbd68328403b03157d730d009972
MD5 a6d28943a33dc7e717795af68581c624
SHA1 f2617f6cffe12de523f0d61322a3d3986c9b2a5d
SHA512 85908aa3ba92f2788728c8ca0e1f16614ad2fbcef4bae35d7779a70ffa80f2a3c5a57ef7f72a06040daeba98d2f213815c16b385a323664f76e33dfb2a4ec47a
SSDEEP 3072:c3fB0uVjn85lq6Kp8StaVu+a/SFiX/l6K:uBRVjb4ja/SU
TLSH
T14FA37D06F7D081BAD46549BA84EF5B32CB33B5091739CDC736481B5E5D222D09B363D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1702235479\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_322477243\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

memory/3820-0-0x000000000040D000-0x000000000040E000-memory.dmp

Download

memory/3820-16-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3820-1-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4564-175-0x0000000004D40000-0x0000000004DC9000-memory.dmp

Download

memory/4564-151-0x00000000217A0000-0x00000000217C3000-memory.dmp

Download

memory/4564-216-0x0000000074DD0000-0x0000000074E51000-memory.dmp

Download

memory/4564-222-0x0000000076810000-0x00000000768C1000-memory.dmp

Download

memory/4564-223-0x0000000004D40000-0x0000000004DC9000-memory.dmp

Download

memory/4564-154-0x0000000073070000-0x0000000073101000-memory.dmp

Download

memory/4564-157-0x0000000077220000-0x000000007729E000-memory.dmp

Download

memory/4564-224-0x0000000074DD0000-0x0000000074E51000-memory.dmp

Download

memory/4564-199-0x0000000075A00000-0x0000000075B55000-memory.dmp

Download

memory/4564-174-0x0000000073050000-0x000000007306C000-memory.dmp

Download

memory/4564-197-0x00000000217A0000-0x00000000217C3000-memory.dmp

Download

memory/4564-158-0x0000000004D40000-0x0000000004DC9000-memory.dmp

Download

memory/4564-159-0x0000000077220000-0x000000007729E000-memory.dmp

Download

memory/4564-160-0x0000000077360000-0x0000000077385000-memory.dmp

Download

memory/4564-173-0x0000000073070000-0x0000000073101000-memory.dmp

Download

memory/4564-176-0x00000000732E0000-0x000000007343D000-memory.dmp

Download

memory/4564-179-0x0000000010000000-0x00000000101B4000-memory.dmp

Download

memory/4564-155-0x0000000004D40000-0x0000000004DC9000-memory.dmp

Download

memory/4564-181-0x0000000073050000-0x000000007306C000-memory.dmp

Download

memory/4564-204-0x00000000732E0000-0x000000007343D000-memory.dmp

Download

memory/4564-147-0x00000000732E0000-0x000000007343D000-memory.dmp

Download

memory/4564-190-0x0000000077360000-0x0000000077385000-memory.dmp

Download

memory/4564-191-0x0000000073070000-0x0000000073101000-memory.dmp

Download

memory/4564-206-0x0000000075A00000-0x0000000075B55000-memory.dmp

Download

memory/4564-148-0x0000000077220000-0x000000007729E000-memory.dmp

Download

memory/4564-198-0x0000000004D40000-0x0000000004DC9000-memory.dmp

Download

memory/4564-149-0x0000000010000000-0x00000000101B4000-memory.dmp

Download

memory/4564-156-0x00000000732E0000-0x000000007343D000-memory.dmp

Download

memory/4564-178-0x0000000077360000-0x0000000077385000-memory.dmp

Download

memory/4564-200-0x00000000768D0000-0x0000000076EAC000-memory.dmp

Download

memory/4564-152-0x0000000004D40000-0x0000000004DC9000-memory.dmp

Download

memory/4564-196-0x0000000027580000-0x0000000027686000-memory.dmp

Download

memory/4564-153-0x0000000077220000-0x000000007729E000-memory.dmp

Download

memory/4564-150-0x0000000027580000-0x0000000027686000-memory.dmp

Download

memory/4564-180-0x0000000073070000-0x0000000073101000-memory.dmp

Download

memory/4564-182-0x0000000027580000-0x0000000027686000-memory.dmp

Download

memory/4564-184-0x0000000004D40000-0x0000000004DC9000-memory.dmp

Download

memory/4564-133-0x0000000004D40000-0x0000000004DC9000-memory.dmp

Download

memory/4564-214-0x0000000076810000-0x00000000768C1000-memory.dmp

Download

memory/4564-215-0x0000000004D40000-0x0000000004DC9000-memory.dmp

Download

memory/4564-185-0x00000000732E0000-0x000000007343D000-memory.dmp

Download

memory/4564-186-0x0000000010000000-0x00000000101B4000-memory.dmp

Download

memory/4564-187-0x0000000027580000-0x0000000027686000-memory.dmp

Download

memory/4564-193-0x0000000004D40000-0x0000000004DC9000-memory.dmp

Download

memory/4564-212-0x0000000073050000-0x000000007306C000-memory.dmp

Download

memory/4564-211-0x0000000073070000-0x0000000073101000-memory.dmp

Download

memory/4564-177-0x0000000077220000-0x000000007729E000-memory.dmp

Download

memory/4564-207-0x0000000074DD0000-0x0000000074E51000-memory.dmp

Download

memory/4564-205-0x0000000076570000-0x0000000076652000-memory.dmp

Download

memory/4564-183-0x00000000217A0000-0x00000000217C3000-memory.dmp

Download

memory/4564-188-0x0000000004D40000-0x0000000004DC9000-memory.dmp

Download

memory/4564-189-0x00000000732E0000-0x000000007343D000-memory.dmp

Download

memory/4564-192-0x0000000027580000-0x0000000027686000-memory.dmp

Download

memory/4564-194-0x00000000732E0000-0x000000007343D000-memory.dmp

Download

memory/4564-195-0x0000000073110000-0x000000007324C000-memory.dmp

Download

memory/4564-201-0x0000000073070000-0x0000000073101000-memory.dmp

Download

memory/4564-220-0x0000000073070000-0x0000000073101000-memory.dmp

Download

memory/4564-202-0x0000000076810000-0x00000000768C1000-memory.dmp

Download

memory/4564-203-0x0000000004D40000-0x0000000004DC9000-memory.dmp

Download

memory/4620-8-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/4620-14-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/4620-15-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/4620-18-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/4620-20-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/4620-22-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/4620-117-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/4620-820-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads